@bobbykim/manguito-cms-api 0.2.0 → 0.3.2

package/dist/index.js

@@ -5,6 +5,9 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
@@ -27,6 +30,931 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
+// src/relations.ts
+function quoteIdent(name) {
+  if (!/^[a-z][a-z0-9_-]*$/.test(name)) throw new Error(`Unsafe identifier: ${name}`);
+  return `"${name}"`;
+}
+function paragraphMediaFieldNames(pType) {
+  return new Set(
+    pType.fields.filter((f) => f.field_type === "image" || f.field_type === "video" || f.field_type === "file").map((f) => f.name)
+  );
+}
+async function fetchParagraphMediaIds(db, pType, itemId, fieldName) {
+  const mediaColumns = pType.fields.filter((f) => f.field_type === "image" || f.field_type === "video" || f.field_type === "file").map((f) => f.db_column.column_name);
+  if (mediaColumns.length === 0) return [];
+  const tbl = import_drizzle_orm2.sql.raw(quoteIdent(pType.db.table_name));
+  const cols = import_drizzle_orm2.sql.join(mediaColumns.map((c) => import_drizzle_orm2.sql.raw(quoteIdent(c))), import_drizzle_orm2.sql`, `);
+  const result = await db.execute(
+    import_drizzle_orm2.sql`SELECT ${cols} FROM ${tbl} WHERE parent_id = ${itemId} AND parent_field = ${fieldName}`
+  );
+  const ids = [];
+  for (const row of result.rows) {
+    for (const col of mediaColumns) {
+      const v = row[col];
+      if (typeof v === "string" && v !== "") ids.push(v);
+    }
+  }
+  return ids;
+}
+function nestedParagraphFields(pType, registry) {
+  if (!registry) return [];
+  const out = [];
+  for (const f of pType.fields) {
+    if (f.db_column !== null) continue;
+    const comp = f.ui_component;
+    if (comp.component !== "paragraph-embed" || !comp.ref) continue;
+    const nType = registry.paragraph_types[comp.ref];
+    if (nType) out.push({ fieldName: f.name, nType });
+  }
+  return out;
+}
+async function fetchParagraphRowIds(db, pType, itemId, fieldName) {
+  const tbl = import_drizzle_orm2.sql.raw(quoteIdent(pType.db.table_name));
+  const result = await db.execute(
+    import_drizzle_orm2.sql`SELECT id FROM ${tbl} WHERE parent_id = ${itemId} AND parent_field = ${fieldName}`
+  );
+  return result.rows.map((r) => r["id"]).filter((id) => typeof id === "string");
+}
+async function persistParagraphField(db, itemId, parentType, fieldName, pType, items, registry) {
+  const removed = await fetchParagraphMediaIds(db, pType, itemId, fieldName);
+  const nested = nestedParagraphFields(pType, registry);
+  if (nested.length > 0) {
+    const staleIds = await fetchParagraphRowIds(db, pType, itemId, fieldName);
+    for (const rowId of staleIds) {
+      for (const n of nested) {
+        const d = await deleteParagraphField(db, rowId, n.fieldName, n.nType, registry);
+        removed.push(...d.removed);
+      }
+    }
+  }
+  const tbl = import_drizzle_orm2.sql.raw(quoteIdent(pType.db.table_name));
+  await db.execute(import_drizzle_orm2.sql`DELETE FROM ${tbl} WHERE parent_id = ${itemId} AND parent_field = ${fieldName}`);
+  const mediaFieldNames = paragraphMediaFieldNames(pType);
+  const added = [];
+  for (let i = 0; i < items.length; i++) {
+    const pItem = items[i];
+    const rowId = import_node_crypto.default.randomUUID();
+    const data = {
+      id: rowId,
+      parent_id: itemId,
+      parent_type: parentType,
+      parent_field: fieldName,
+      order: i,
+      created_at: /* @__PURE__ */ new Date(),
+      updated_at: /* @__PURE__ */ new Date()
+    };
+    for (const pf of pType.fields) {
+      if (!pf.db_column || pf.db_column.junction) continue;
+      data[pf.db_column.column_name] = pItem[pf.name] ?? null;
+    }
+    const cols = import_drizzle_orm2.sql.join(Object.keys(data).map((k) => import_drizzle_orm2.sql.raw(quoteIdent(k))), import_drizzle_orm2.sql`, `);
+    const vals = import_drizzle_orm2.sql.join(Object.values(data).map((v) => import_drizzle_orm2.sql`${v}`), import_drizzle_orm2.sql`, `);
+    await db.execute(import_drizzle_orm2.sql`INSERT INTO ${tbl} (${cols}) VALUES (${vals})`);
+    for (const name of mediaFieldNames) {
+      const val = pItem[name];
+      if (typeof val === "string" && val !== "") added.push(val);
+    }
+    for (const n of nested) {
+      const nestedItems = Array.isArray(pItem[n.fieldName]) ? pItem[n.fieldName] : [];
+      const d = await persistParagraphField(
+        db,
+        rowId,
+        pType.db.table_name,
+        n.fieldName,
+        n.nType,
+        nestedItems,
+        registry
+      );
+      added.push(...d.added);
+      removed.push(...d.removed);
+    }
+  }
+  return { added, removed };
+}
+async function deleteParagraphField(db, itemId, fieldName, pType, registry) {
+  const removed = await fetchParagraphMediaIds(db, pType, itemId, fieldName);
+  const nested = nestedParagraphFields(pType, registry);
+  if (nested.length > 0) {
+    const rowIds = await fetchParagraphRowIds(db, pType, itemId, fieldName);
+    for (const rowId of rowIds) {
+      for (const n of nested) {
+        const d = await deleteParagraphField(db, rowId, n.fieldName, n.nType, registry);
+        removed.push(...d.removed);
+      }
+    }
+  }
+  const tbl = import_drizzle_orm2.sql.raw(quoteIdent(pType.db.table_name));
+  await db.execute(import_drizzle_orm2.sql`DELETE FROM ${tbl} WHERE parent_id = ${itemId} AND parent_field = ${fieldName}`);
+  return { added: [], removed };
+}
+async function persistJunctionField(db, itemId, junction, relatedIds) {
+  const tbl = import_drizzle_orm2.sql.raw(quoteIdent(junction.table_name));
+  const left = import_drizzle_orm2.sql.raw(quoteIdent(junction.left_column));
+  const right = import_drizzle_orm2.sql.raw(quoteIdent(junction.right_column));
+  await db.execute(import_drizzle_orm2.sql`DELETE FROM ${tbl} WHERE ${left} = ${itemId}`);
+  for (const rid of relatedIds) {
+    await db.execute(import_drizzle_orm2.sql`INSERT INTO ${tbl} (${left}, ${right}) VALUES (${itemId}, ${rid})`);
+  }
+}
+function buildRelationsMap(fields, registry) {
+  const relations = {};
+  for (const field of fields) {
+    if (field.field_type === "image" || field.field_type === "video" || field.field_type === "file") {
+      if (!field.db_column) continue;
+      relations[field.name] = { type: "media", fk_column: field.db_column.column_name };
+    } else if (field.field_type === "paragraph") {
+      const ref = field.ui_component.ref;
+      const pType = ref ? registry.paragraph_types[ref] : void 0;
+      if (!pType) continue;
+      relations[field.name] = { type: "paragraph", table: pType.db.table_name };
+    } else if (field.field_type === "reference") {
+      if (!field.db_column) continue;
+      if (field.db_column.junction) {
+        const j = field.db_column.junction;
+        relations[field.name] = {
+          type: "junction",
+          table: j.right_table,
+          junction_table: j.table_name,
+          left_column: j.left_column,
+          right_column: j.right_column,
+          order_column: j.order_column
+        };
+      } else if (field.db_column.foreign_key) {
+        relations[field.name] = {
+          type: "reference",
+          table: field.db_column.foreign_key.table,
+          fk_column: field.db_column.column_name
+        };
+      }
+    }
+  }
+  return relations;
+}
+function groupBy(items, key) {
+  const result = {};
+  for (const item of items) {
+    const k = String(item[key]);
+    if (!result[k]) result[k] = [];
+    result[k].push(item);
+  }
+  return result;
+}
+async function resolveRelationField(db, rows, fieldName, rel, cache, publishedOnly = false) {
+  if (rows.length === 0) return;
+  if (rel.type === "paragraph") {
+    const parentIds = rows.map((r) => r["id"]);
+    const inList = import_drizzle_orm2.sql.join(parentIds.map((id) => import_drizzle_orm2.sql`${id}`), import_drizzle_orm2.sql`, `);
+    const result = await db.execute(
+      import_drizzle_orm2.sql`SELECT * FROM ${import_drizzle_orm2.sql.raw(quoteIdent(rel.table))} WHERE parent_id IN (${inList}) AND parent_field = ${fieldName} ORDER BY "order" ASC`
+    );
+    const byParent = groupBy(result.rows, "parent_id");
+    for (const row of rows) {
+      row[fieldName] = byParent[row["id"]] ?? [];
+    }
+  } else if (rel.type === "reference") {
+    const fkValues = rows.map((r) => r[rel.fk_column]).filter(Boolean);
+    if (fkValues.length === 0) {
+      for (const row of rows) row[fieldName] = null;
+      return;
+    }
+    const unique = [...new Set(fkValues)];
+    const uncached = unique.filter((id) => !cache.has(`${rel.table}:${id}`));
+    if (uncached.length > 0) {
+      const inList = import_drizzle_orm2.sql.join(uncached.map((id) => import_drizzle_orm2.sql`${id}`), import_drizzle_orm2.sql`, `);
+      const publishedCond = publishedOnly ? import_drizzle_orm2.sql` AND published = true` : import_drizzle_orm2.sql``;
+      const result = await db.execute(
+        import_drizzle_orm2.sql`SELECT * FROM ${import_drizzle_orm2.sql.raw(quoteIdent(rel.table))} WHERE id IN (${inList})${publishedCond}`
+      );
+      for (const item of result.rows) {
+        cache.set(`${rel.table}:${item["id"]}`, item);
+      }
+    }
+    for (const row of rows) {
+      const fkVal = row[rel.fk_column];
+      row[fieldName] = fkVal ? cache.get(`${rel.table}:${fkVal}`) ?? null : null;
+    }
+  } else if (rel.type === "junction") {
+    const parentIds = rows.map((r) => r["id"]);
+    const inList = import_drizzle_orm2.sql.join(parentIds.map((id) => import_drizzle_orm2.sql`${id}`), import_drizzle_orm2.sql`, `);
+    const orderBy = rel.order_column ? import_drizzle_orm2.sql` ORDER BY "order" ASC` : import_drizzle_orm2.sql``;
+    const junctionResult = await db.execute(
+      import_drizzle_orm2.sql`SELECT * FROM ${import_drizzle_orm2.sql.raw(quoteIdent(rel.junction_table))} WHERE ${import_drizzle_orm2.sql.raw(quoteIdent(rel.left_column))} IN (${inList})${orderBy}`
+    );
+    const jRows = junctionResult.rows;
+    const rightIds = [...new Set(jRows.map((r) => r[rel.right_column]))];
+    const uncached = rightIds.filter((id) => !cache.has(`${rel.table}:${id}`));
+    if (uncached.length > 0) {
+      const rightInList = import_drizzle_orm2.sql.join(uncached.map((id) => import_drizzle_orm2.sql`${id}`), import_drizzle_orm2.sql`, `);
+      const publishedCond = publishedOnly ? import_drizzle_orm2.sql` AND published = true` : import_drizzle_orm2.sql``;
+      const entitiesResult = await db.execute(
+        import_drizzle_orm2.sql`SELECT * FROM ${import_drizzle_orm2.sql.raw(quoteIdent(rel.table))} WHERE id IN (${rightInList})${publishedCond}`
+      );
+      for (const item of entitiesResult.rows) {
+        cache.set(`${rel.table}:${item["id"]}`, item);
+      }
+    }
+    const byLeft = groupBy(jRows, rel.left_column);
+    for (const row of rows) {
+      const jEntries = byLeft[row["id"]] ?? [];
+      row[fieldName] = jEntries.map((jr) => cache.get(`${rel.table}:${jr[rel.right_column]}`)).filter(Boolean);
+    }
+  } else if (rel.type === "media") {
+    const fkValues = rows.map((r) => r[rel.fk_column]).filter(Boolean);
+    if (fkValues.length === 0) {
+      for (const row of rows) row[fieldName] = null;
+      return;
+    }
+    const unique = [...new Set(fkValues)];
+    const uncached = unique.filter((id) => !cache.has(`media:${id}`));
+    if (uncached.length > 0) {
+      const inList = import_drizzle_orm2.sql.join(uncached.map((id) => import_drizzle_orm2.sql`${id}`), import_drizzle_orm2.sql`, `);
+      const result = await db.execute(import_drizzle_orm2.sql`SELECT * FROM "media" WHERE id IN (${inList})`);
+      for (const item of result.rows) {
+        cache.set(`media:${item["id"]}`, item);
+      }
+    }
+    for (const row of rows) {
+      const fkVal = row[rel.fk_column];
+      row[fieldName] = fkVal ? cache.get(`media:${fkVal}`) ?? null : null;
+    }
+  }
+}
+async function resolveRelationBareIds(db, rows, fieldName, rel) {
+  if (rows.length === 0) return;
+  if (rel.type === "paragraph") {
+    const parentIds = rows.map((r) => r["id"]);
+    const inList = import_drizzle_orm2.sql.join(parentIds.map((id) => import_drizzle_orm2.sql`${id}`), import_drizzle_orm2.sql`, `);
+    const result = await db.execute(
+      import_drizzle_orm2.sql`SELECT id, parent_id FROM ${import_drizzle_orm2.sql.raw(quoteIdent(rel.table))} WHERE parent_id IN (${inList}) AND parent_field = ${fieldName} ORDER BY "order" ASC`
+    );
+    const byParent = groupBy(result.rows, "parent_id");
+    for (const row of rows) {
+      row[fieldName] = (byParent[row["id"]] ?? []).map((r) => r["id"]);
+    }
+  } else if (rel.type === "junction") {
+    const parentIds = rows.map((r) => r["id"]);
+    const inList = import_drizzle_orm2.sql.join(parentIds.map((id) => import_drizzle_orm2.sql`${id}`), import_drizzle_orm2.sql`, `);
+    const result = await db.execute(
+      import_drizzle_orm2.sql`SELECT ${import_drizzle_orm2.sql.raw(quoteIdent(rel.left_column))} AS left_id, ${import_drizzle_orm2.sql.raw(quoteIdent(rel.right_column))} AS right_id FROM ${import_drizzle_orm2.sql.raw(quoteIdent(rel.junction_table))} WHERE ${import_drizzle_orm2.sql.raw(quoteIdent(rel.left_column))} IN (${inList})`
+    );
+    const byLeft = groupBy(result.rows, "left_id");
+    for (const row of rows) {
+      row[fieldName] = (byLeft[row["id"]] ?? []).map((r) => r["right_id"]);
+    }
+  }
+}
+var import_node_crypto, import_drizzle_orm2;
+var init_relations = __esm({
+  "src/relations.ts"() {
+    "use strict";
+    import_node_crypto = __toESM(require("crypto"));
+    import_drizzle_orm2 = require("drizzle-orm");
+  }
+});
+
+// src/graphql/scalars.ts
+var import_graphql, DateTimeScalar, JSONScalar;
+var init_scalars = __esm({
+  "src/graphql/scalars.ts"() {
+    "use strict";
+    import_graphql = require("graphql");
+    DateTimeScalar = new import_graphql.GraphQLScalarType({
+      name: "DateTime",
+      description: "ISO-8601 date-time string",
+      serialize(value) {
+        if (value instanceof Date) return value.toISOString();
+        if (typeof value === "string") return value;
+        if (typeof value === "number") return new Date(value).toISOString();
+        throw new TypeError(`DateTime cannot serialize value: ${String(value)}`);
+      },
+      parseValue(value) {
+        if (typeof value !== "string") throw new TypeError("DateTime must be a string");
+        return value;
+      },
+      parseLiteral(ast) {
+        if (ast.kind !== import_graphql.Kind.STRING) throw new TypeError("DateTime must be a string");
+        return ast.value;
+      }
+    });
+    JSONScalar = new import_graphql.GraphQLScalarType({
+      name: "JSON",
+      description: "Arbitrary JSON value",
+      serialize: (value) => value,
+      parseValue: (value) => value,
+      parseLiteral: (ast, variables) => (0, import_graphql.valueFromASTUntyped)(ast, variables ?? void 0)
+    });
+  }
+});
+
+// src/graphql/type-mapping.ts
+function scalarOutputType(fieldType) {
+  switch (fieldType) {
+    case "text/plain":
+    case "text/rich":
+      return import_graphql2.GraphQLString;
+    case "integer":
+      return import_graphql2.GraphQLInt;
+    case "float":
+      return import_graphql2.GraphQLFloat;
+    case "boolean":
+      return import_graphql2.GraphQLBoolean;
+    case "date":
+      return DateTimeScalar;
+    case "programmatic":
+      return JSONScalar;
+    default:
+      return null;
+  }
+}
+var import_graphql2;
+var init_type_mapping = __esm({
+  "src/graphql/type-mapping.ts"() {
+    "use strict";
+    import_graphql2 = require("graphql");
+    init_scalars();
+  }
+});
+
+// src/graphql/naming.ts
+function schemaSegment(machineName) {
+  const idx = machineName.indexOf("--");
+  return idx === -1 ? machineName : machineName.slice(idx + 2);
+}
+function words(input) {
+  return input.split(/[_\s-]+/).filter(Boolean);
+}
+function toPascalCase(input) {
+  return words(input).map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join("");
+}
+function toCamelCase(input) {
+  const pascal = toPascalCase(input);
+  return pascal.charAt(0).toLowerCase() + pascal.slice(1);
+}
+function pluralize(word) {
+  if (/[^aeiou]y$/.test(word)) return word.slice(0, -1) + "ies";
+  if (/(s|x|z|ch|sh)$/.test(word)) return word + "es";
+  return word + "s";
+}
+function isValidGraphQLName(name) {
+  return GRAPHQL_NAME.test(name);
+}
+function graphqlTypeName(machineName) {
+  return toPascalCase(schemaSegment(machineName));
+}
+function singleQueryName(machineName) {
+  return toCamelCase(schemaSegment(machineName));
+}
+function collectionQueryName(machineName) {
+  return pluralize(singleQueryName(machineName));
+}
+function buildFieldNameMap(schemaNames) {
+  const toG = /* @__PURE__ */ new Map();
+  const toS = /* @__PURE__ */ new Map();
+  for (const name of schemaNames) {
+    const g = toCamelCase(name);
+    toG.set(name, g);
+    toS.set(g, name);
+  }
+  return {
+    toGraphql: (schemaName) => toG.get(schemaName) ?? toCamelCase(schemaName),
+    toSchema: (graphqlName) => toS.get(graphqlName) ?? graphqlName
+  };
+}
+var GRAPHQL_NAME;
+var init_naming = __esm({
+  "src/graphql/naming.ts"() {
+    "use strict";
+    GRAPHQL_NAME = /^[_A-Za-z][_0-9A-Za-z]*$/;
+  }
+});
+
+// src/graphql/filters.ts
+function buildSortFieldEnum(typeName) {
+  return new import_graphql3.GraphQLEnumType({
+    name: `${typeName}SortField`,
+    values: Object.fromEntries(SORTABLE.map((s) => [s.gql, { value: s.column }]))
+  });
+}
+function comparableFilterInput(name, scalar) {
+  return new import_graphql3.GraphQLInputObjectType({
+    name,
+    fields: {
+      eq: { type: scalar },
+      in: { type: new import_graphql3.GraphQLList(new import_graphql3.GraphQLNonNull(scalar)) },
+      gt: { type: scalar },
+      gte: { type: scalar },
+      lt: { type: scalar },
+      lte: { type: scalar }
+    }
+  });
+}
+function equalityFilterInput(name, scalar) {
+  return new import_graphql3.GraphQLInputObjectType({
+    name,
+    fields: {
+      eq: { type: scalar },
+      in: { type: new import_graphql3.GraphQLList(new import_graphql3.GraphQLNonNull(scalar)) }
+    }
+  });
+}
+function filterInputForField(fieldType) {
+  const scalar = scalarOutputType(fieldType);
+  if (fieldType === "boolean") return BooleanFilter;
+  if (fieldType === "date") return DateTimeFilter;
+  if (fieldType === "integer") return IntFilter;
+  if (fieldType === "float") return FloatFilter;
+  if (fieldType === "reference") return IDFilter;
+  if (scalar === null) return null;
+  return StringFilter;
+}
+function buildFilterInputType(type) {
+  const fields = {};
+  fields["id"] = { type: IDFilter };
+  fields["published"] = { type: BooleanFilter };
+  fields["createdAt"] = { type: DateTimeFilter };
+  fields["updatedAt"] = { type: DateTimeFilter };
+  if (type.schema_type === "content-type") fields["slug"] = { type: StringFilter };
+  for (const f of type.fields) {
+    if (f.field_type === "programmatic" || f.field_type === "paragraph") continue;
+    if (f.field_type === "image" || f.field_type === "video" || f.field_type === "file") continue;
+    const input = filterInputForField(f.field_type);
+    if (input) fields[buildFieldNameMap([f.name]).toGraphql(f.name)] = { type: input };
+  }
+  if (Object.keys(fields).length === 0) return null;
+  return new import_graphql3.GraphQLInputObjectType({ name: `${graphqlTypeName(type.name)}Filter`, fields });
+}
+function translateFilters(input, nameMap) {
+  const out = {};
+  if (!input) return out;
+  for (const [gqlField, raw] of Object.entries(input)) {
+    if (raw === null || typeof raw !== "object") continue;
+    const column = nameMap.toSchema(gqlField);
+    const spec = raw;
+    if (spec["eq"] !== void 0) {
+      out[column] = spec["eq"];
+    } else if (Array.isArray(spec["in"])) {
+      out[column] = spec["in"];
+    } else {
+      const op = {};
+      for (const k of ["gt", "gte", "lt", "lte"]) {
+        if (spec[k] !== void 0) op[k] = spec[k];
+      }
+      if (Object.keys(op).length > 0) out[column] = op;
+    }
+  }
+  return out;
+}
+var import_graphql3, SortOrderEnum, SORTABLE, StringFilter, BooleanFilter, DateTimeFilter, IDFilter, IntFilter, FloatFilter;
+var init_filters = __esm({
+  "src/graphql/filters.ts"() {
+    "use strict";
+    import_graphql3 = require("graphql");
+    init_naming();
+    init_type_mapping();
+    init_scalars();
+    SortOrderEnum = new import_graphql3.GraphQLEnumType({
+      name: "SortOrder",
+      values: { ASC: { value: "asc" }, DESC: { value: "desc" } }
+    });
+    SORTABLE = [
+      { gql: "title", column: "title" },
+      { gql: "createdAt", column: "created_at" },
+      { gql: "updatedAt", column: "updated_at" }
+    ];
+    StringFilter = equalityFilterInput("StringFilter", import_graphql3.GraphQLString);
+    BooleanFilter = new import_graphql3.GraphQLInputObjectType({
+      name: "BooleanFilter",
+      fields: { eq: { type: import_graphql3.GraphQLBoolean } }
+    });
+    DateTimeFilter = comparableFilterInput("DateTimeFilter", DateTimeScalar);
+    IDFilter = equalityFilterInput("IDFilter", import_graphql3.GraphQLString);
+    IntFilter = comparableFilterInput("IntFilter", import_graphql3.GraphQLInt);
+    FloatFilter = comparableFilterInput("FloatFilter", import_graphql3.GraphQLFloat);
+  }
+});
+
+// src/graphql/resolvers.ts
+function codeError2(code, message) {
+  return new import_graphql4.GraphQLError(message, { extensions: { code } });
+}
+function isPublished2(item) {
+  return !!item && item["published"] === true;
+}
+function scalarFieldResolver(schemaName) {
+  return (parent) => parent[schemaName];
+}
+function relationFieldResolver(typeName, schemaFieldName) {
+  return (parent, _args, ctx) => ctx.loaders.load(typeName, schemaFieldName, parent);
+}
+function programmaticFieldResolver(typeName, schemaFieldName, mediaFieldNames = []) {
+  return async (parent, _args, ctx) => {
+    let p = ctx.programmaticMemo.get(parent);
+    if (!p) {
+      p = resolveProgrammaticRow(typeName, parent, ctx, mediaFieldNames);
+      ctx.programmaticMemo.set(parent, p);
+    }
+    return (await p)[schemaFieldName];
+  };
+}
+async function resolveProgrammaticRow(typeName, parent, ctx, mediaFieldNames) {
+  if (mediaFieldNames.length === 0) return ctx.resolver.resolveItem(typeName, parent);
+  const enriched = { ...parent };
+  await Promise.all(mediaFieldNames.map((name) => ctx.loaders.load(typeName, name, enriched)));
+  return ctx.resolver.resolveItem(typeName, enriched);
+}
+function collectionResolver(typeName, nameMap) {
+  return async (_root, args, ctx) => {
+    const page = args.page ?? 1;
+    const perPage = args.perPage ?? 10;
+    if (!Number.isInteger(page) || page < 1) {
+      throw codeError2("INVALID_PAGINATION", "page must be \u2265 1");
+    }
+    if (!Number.isInteger(perPage) || perPage < 1 || perPage > 100) {
+      throw codeError2("INVALID_PAGINATION", "perPage must be between 1 and 100");
+    }
+    const repo = ctx.repos[typeName];
+    const result = await repo.findMany({
+      published_only: true,
+      page,
+      per_page: perPage,
+      sort_by: args.sortBy ?? "created_at",
+      sort_order: args.sortOrder ?? "asc",
+      filters: translateFilters(args.filter, nameMap)
+    });
+    return { data: result.data, meta: result.meta };
+  };
+}
+function singleBySlugResolver(typeName) {
+  return async (_root, args, ctx) => {
+    const repo = ctx.repos[typeName];
+    const item = await repo.findBySlug(args.slug);
+    return isPublished2(item) ? item : null;
+  };
+}
+function singletonResolver(typeName) {
+  return async (_root, _args, ctx) => {
+    const repo = ctx.repos[typeName];
+    const result = await repo.findMany({ published_only: true, page: 1, per_page: 1 });
+    return result.data[0] ?? null;
+  };
+}
+function taxonomySingleResolver(typeName) {
+  return async (_root, args, ctx) => {
+    const repo = ctx.repos[typeName];
+    const item = await repo.findOne(args.id);
+    return isPublished2(item) ? item : null;
+  };
+}
+var import_graphql4;
+var init_resolvers = __esm({
+  "src/graphql/resolvers.ts"() {
+    "use strict";
+    import_graphql4 = require("graphql");
+    init_filters();
+  }
+});
+
+// src/graphql/schema.ts
+function buildGraphQLSchema(registry) {
+  const objectTypes = /* @__PURE__ */ new Map();
+  const enumTypes = /* @__PURE__ */ new Map();
+  for (const [name, enumType] of Object.entries(registry.enum_types)) {
+    if (enumType.values.every(isValidGraphQLName)) {
+      enumTypes.set(
+        name,
+        new import_graphql5.GraphQLEnumType({
+          name: graphqlTypeName(name),
+          values: Object.fromEntries(enumType.values.map((v) => [v, { value: v }]))
+        })
+      );
+    } else {
+      process.stderr.write(
+        `\u26A0 enum '${name}' has values that aren't valid GraphQL identifiers; exposing as String
+`
+      );
+    }
+  }
+  function outputTypeForField(field) {
+    const scalar = scalarOutputType(field.field_type);
+    if (scalar) return field.required ? new import_graphql5.GraphQLNonNull(scalar) : scalar;
+    if (field.field_type === "enum") {
+      const ref = field.ui_component.component === "select" ? field.ui_component.enum_ref : void 0;
+      const et = ref ? enumTypes.get(ref) : void 0;
+      const t = et ?? import_graphql5.GraphQLString;
+      return field.required ? new import_graphql5.GraphQLNonNull(t) : t;
+    }
+    if (field.field_type === "image" || field.field_type === "video" || field.field_type === "file") {
+      return MEDIA;
+    }
+    if (field.field_type === "paragraph") {
+      const ref = field.ui_component.component === "paragraph-embed" ? field.ui_component.ref : void 0;
+      const target = ref ? objectTypes.get(ref) : void 0;
+      if (ref && !target) {
+        process.stderr.write(
+          `\u26A0 paragraph field '${field.name}' targets unknown paragraph type '${ref}'; exposing as Media
+`
+        );
+      }
+      return new import_graphql5.GraphQLList(new import_graphql5.GraphQLNonNull(target ?? MEDIA));
+    }
+    if (field.field_type === "reference") {
+      const ref = field.ui_component.component === "typeahead-select" ? field.ui_component.ref : void 0;
+      const target = ref ? objectTypes.get(ref) : void 0;
+      if (ref && !target) {
+        process.stderr.write(`\u26A0 reference field '${field.name}' targets unknown type '${ref}'; exposing as Media
+`);
+      }
+      const rel = field.ui_component.component === "typeahead-select" ? field.ui_component.rel : void 0;
+      const isMany = rel === "many-to-many" || rel === "one-to-many";
+      const t = target ?? MEDIA;
+      return isMany ? new import_graphql5.GraphQLList(new import_graphql5.GraphQLNonNull(t)) : t;
+    }
+    return import_graphql5.GraphQLString;
+  }
+  function buildObjectType(machineName, type) {
+    const mediaFieldNames = type.fields.filter((f) => f.field_type === "image" || f.field_type === "video" || f.field_type === "file").map((f) => f.name);
+    return new import_graphql5.GraphQLObjectType({
+      name: graphqlTypeName(machineName),
+      fields: () => {
+        const fields = {};
+        fields["id"] = { type: new import_graphql5.GraphQLNonNull(import_graphql5.GraphQLID), resolve: (p) => p["id"] };
+        if (type.schema_type !== "paragraph-type") {
+          fields["published"] = { type: new import_graphql5.GraphQLNonNull(import_graphql5.GraphQLBoolean), resolve: (p) => p["published"] };
+        }
+        if (type.schema_type === "content-type") {
+          fields["slug"] = { type: new import_graphql5.GraphQLNonNull(import_graphql5.GraphQLString), resolve: (p) => p["slug"] };
+        }
+        fields["createdAt"] = { type: new import_graphql5.GraphQLNonNull(DateTimeScalar), resolve: (p) => p["created_at"] };
+        fields["updatedAt"] = { type: new import_graphql5.GraphQLNonNull(DateTimeScalar), resolve: (p) => p["updated_at"] };
+        for (const field of type.fields) {
+          const gqlName = toCamelCase(field.name);
+          const outType = outputTypeForField(field);
+          let resolve;
+          if (field.field_type === "programmatic") {
+            resolve = programmaticFieldResolver(machineName, field.name, mediaFieldNames);
+          } else if (field.field_type === "reference" || field.field_type === "paragraph" || field.field_type === "image" || field.field_type === "video" || field.field_type === "file") {
+            resolve = relationFieldResolver(machineName, field.name);
+          } else {
+            resolve = scalarFieldResolver(field.name);
+          }
+          fields[gqlName] = { type: outType, resolve };
+        }
+        return fields;
+      }
+    });
+  }
+  const typeNameOwners = /* @__PURE__ */ new Map();
+  function registerTypeName(machineName) {
+    const gqlName = graphqlTypeName(machineName);
+    const owner = typeNameOwners.get(gqlName);
+    if (owner !== void 0 && owner !== machineName) {
+      throw new Error(
+        `GraphQL type name collision: '${gqlName}' is produced by both '${owner}' and '${machineName}'. Rename one schema's machine name segment so their GraphQL type names differ.`
+      );
+    }
+    typeNameOwners.set(gqlName, machineName);
+  }
+  for (const [name, ct] of Object.entries(registry.content_types)) {
+    registerTypeName(name);
+    objectTypes.set(name, buildObjectType(name, ct));
+  }
+  for (const [name, tt] of Object.entries(registry.taxonomy_types)) {
+    registerTypeName(name);
+    objectTypes.set(name, buildObjectType(name, tt));
+  }
+  for (const [name, pt] of Object.entries(registry.paragraph_types)) {
+    registerTypeName(name);
+    objectTypes.set(name, buildObjectType(name, pt));
+  }
+  const queryFields = {};
+  for (const [name, ct] of Object.entries(registry.content_types)) {
+    const objType = objectTypes.get(name);
+    const nameMap = buildFieldNameMap(ct.fields.map((f) => f.name));
+    if (ct.only_one) {
+      queryFields[singleQueryName(name)] = { type: objType, resolve: singletonResolver(name) };
+      continue;
+    }
+    const listType = new import_graphql5.GraphQLObjectType({
+      name: `${graphqlTypeName(name)}List`,
+      fields: {
+        data: { type: new import_graphql5.GraphQLNonNull(new import_graphql5.GraphQLList(new import_graphql5.GraphQLNonNull(objType))), resolve: (r) => r.data },
+        meta: { type: new import_graphql5.GraphQLNonNull(PAGE_META), resolve: (r) => r.meta }
+      }
+    });
+    const filterType = buildFilterInputType(ct);
+    queryFields[collectionQueryName(name)] = {
+      type: new import_graphql5.GraphQLNonNull(listType),
+      args: {
+        page: { type: import_graphql5.GraphQLInt },
+        perPage: { type: import_graphql5.GraphQLInt },
+        sortBy: { type: buildSortFieldEnum(graphqlTypeName(name)) },
+        sortOrder: { type: SortOrderEnum },
+        ...filterType ? { filter: { type: filterType } } : {}
+      },
+      resolve: collectionResolver(name, nameMap)
+    };
+    queryFields[singleQueryName(name)] = {
+      type: objType,
+      args: { slug: { type: new import_graphql5.GraphQLNonNull(import_graphql5.GraphQLString) } },
+      resolve: singleBySlugResolver(name)
+    };
+  }
+  for (const [name, tt] of Object.entries(registry.taxonomy_types)) {
+    const objType = objectTypes.get(name);
+    const listType = new import_graphql5.GraphQLObjectType({
+      name: `${graphqlTypeName(name)}List`,
+      fields: {
+        data: { type: new import_graphql5.GraphQLNonNull(new import_graphql5.GraphQLList(new import_graphql5.GraphQLNonNull(objType))), resolve: (r) => r.data },
+        meta: { type: new import_graphql5.GraphQLNonNull(PAGE_META), resolve: (r) => r.meta }
+      }
+    });
+    queryFields[collectionQueryName(name)] = {
+      type: new import_graphql5.GraphQLNonNull(listType),
+      args: { page: { type: import_graphql5.GraphQLInt }, perPage: { type: import_graphql5.GraphQLInt } },
+      resolve: collectionResolver(name, buildFieldNameMap(tt.fields.map((f) => f.name)))
+    };
+    queryFields[singleQueryName(name)] = {
+      type: objType,
+      args: { id: { type: new import_graphql5.GraphQLNonNull(import_graphql5.GraphQLID) } },
+      resolve: taxonomySingleResolver(name)
+    };
+  }
+  return new import_graphql5.GraphQLSchema({
+    query: new import_graphql5.GraphQLObjectType({ name: "Query", fields: queryFields })
+  });
+}
+var import_graphql5, PAGE_META, MEDIA;
+var init_schema = __esm({
+  "src/graphql/schema.ts"() {
+    "use strict";
+    import_graphql5 = require("graphql");
+    init_scalars();
+    init_type_mapping();
+    init_naming();
+    init_filters();
+    init_resolvers();
+    PAGE_META = new import_graphql5.GraphQLObjectType({
+      name: "PageMeta",
+      fields: {
+        total: { type: new import_graphql5.GraphQLNonNull(import_graphql5.GraphQLInt), resolve: (m) => m.total },
+        page: { type: new import_graphql5.GraphQLNonNull(import_graphql5.GraphQLInt), resolve: (m) => m.page },
+        perPage: { type: new import_graphql5.GraphQLNonNull(import_graphql5.GraphQLInt), resolve: (m) => m.per_page },
+        totalPages: { type: new import_graphql5.GraphQLNonNull(import_graphql5.GraphQLInt), resolve: (m) => m.total_pages },
+        hasNext: { type: new import_graphql5.GraphQLNonNull(import_graphql5.GraphQLBoolean), resolve: (m) => m.has_next },
+        hasPrev: { type: new import_graphql5.GraphQLNonNull(import_graphql5.GraphQLBoolean), resolve: (m) => m.has_prev }
+      }
+    });
+    MEDIA = new import_graphql5.GraphQLObjectType({
+      name: "Media",
+      fields: {
+        id: { type: new import_graphql5.GraphQLNonNull(import_graphql5.GraphQLID), resolve: (m) => m.id },
+        type: { type: new import_graphql5.GraphQLNonNull(import_graphql5.GraphQLString), resolve: (m) => m.type },
+        url: { type: new import_graphql5.GraphQLNonNull(import_graphql5.GraphQLString), resolve: (m) => m.url },
+        mimeType: { type: new import_graphql5.GraphQLNonNull(import_graphql5.GraphQLString), resolve: (m) => m.mime_type },
+        alt: { type: import_graphql5.GraphQLString, resolve: (m) => m.alt },
+        fileSize: { type: import_graphql5.GraphQLInt, resolve: (m) => m.file_size },
+        width: { type: import_graphql5.GraphQLInt, resolve: (m) => m.width },
+        height: { type: import_graphql5.GraphQLInt, resolve: (m) => m.height },
+        duration: { type: import_graphql5.GraphQLInt, resolve: (m) => m.duration }
+      }
+    });
+  }
+});
+
+// src/graphql/dataloaders.ts
+function createRelationLoaders(db, registry) {
+  const relMaps = /* @__PURE__ */ new Map();
+  const loaders = /* @__PURE__ */ new Map();
+  const cache = /* @__PURE__ */ new Map();
+  function relationsFor(typeName) {
+    let m = relMaps.get(typeName);
+    if (!m) {
+      const type = registry.content_types[typeName] ?? registry.taxonomy_types[typeName] ?? registry.paragraph_types[typeName];
+      m = type ? buildRelationsMap(type.fields, registry) : {};
+      relMaps.set(typeName, m);
+    }
+    return m;
+  }
+  function loaderFor(typeName, fieldName, rel) {
+    const key = `${typeName}:${fieldName}`;
+    let dl = loaders.get(key);
+    if (!dl) {
+      dl = new import_dataloader.default(
+        async (parents) => {
+          const rows = parents;
+          await resolveRelationField(db, rows, fieldName, rel, cache, true);
+          return rows.map((r) => r[fieldName]);
+        },
+        // Batch within a tick; do not memoize by parent identity (rows are mutated
+        // and may recur across nesting levels).
+        { cache: false }
+      );
+      loaders.set(key, dl);
+    }
+    return dl;
+  }
+  return {
+    async load(typeName, fieldName, parent) {
+      const rel = relationsFor(typeName)[fieldName];
+      if (!rel) return null;
+      return loaderFor(typeName, fieldName, rel).load(parent);
+    }
+  };
+}
+var import_dataloader;
+var init_dataloaders = __esm({
+  "src/graphql/dataloaders.ts"() {
+    "use strict";
+    import_dataloader = __toESM(require("dataloader"));
+    init_relations();
+  }
+});
+
+// src/graphql/security.ts
+function buildArmorPlugin(options) {
+  const armor = new import_graphql_armor.EnvelopArmor({
+    maxDepth: { n: options.maxDepth },
+    costLimit: { maxCost: options.maxComplexity },
+    maxAliases: { n: 15 },
+    maxDirectives: { n: 50 },
+    blockFieldSuggestion: { enabled: true }
+    // maxTokens is intentionally left at Armor's secure default (n=1000) to bound
+    // GraphQL document token count at parse time, a layer the depth/cost/alias/directive
+    // limits do not cover.
+  });
+  return armor.protect();
+}
+function introspectionPlugin(enabled) {
+  return {
+    onValidate({ addValidationRule }) {
+      if (!enabled) addValidationRule(import_graphql6.NoSchemaIntrospectionCustomRule);
+    }
+  };
+}
+var import_graphql_armor, import_graphql6;
+var init_security = __esm({
+  "src/graphql/security.ts"() {
+    "use strict";
+    import_graphql_armor = require("@escape.tech/graphql-armor");
+    import_graphql6 = require("graphql");
+  }
+});
+
+// src/graphql/handler.ts
+var handler_exports = {};
+__export(handler_exports, {
+  createGraphQLHandler: () => createGraphQLHandler
+});
+function isClientSafeGraphQLError(error) {
+  let current = error;
+  while (current != null && typeof current === "object" && current.name === "GraphQLError") {
+    if (current.originalError == null) return true;
+    current = current.originalError;
+  }
+  return false;
+}
+function createGraphQLHandler(registry, repos, resolver, db, options) {
+  const schema = buildGraphQLSchema(registry);
+  const { plugins } = buildArmorPlugin({
+    maxDepth: options.maxDepth,
+    maxComplexity: options.maxComplexity
+  });
+  const yoga = (0, import_graphql_yoga.createYoga)({
+    schema,
+    graphqlEndpoint: "/graphql",
+    graphiql: options.graphiql,
+    landingPage: false,
+    maskedErrors: {
+      maskError: (error, message, isDev) => isClientSafeGraphQLError(error) ? error : (0, import_graphql_yoga.maskError)(error, message, isDev)
+    },
+    // buildArmorPlugin's return type is `unknown[]` (see security.ts) since Armor's
+    // plugin shapes aren't part of its public typings; Yoga's `plugins` option only
+    // accepts its own `Plugin` type, so the cast bridges the two.
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    plugins: [...plugins, introspectionPlugin(options.introspection)],
+    context: () => ({
+      db,
+      registry,
+      repos,
+      resolver,
+      loaders: createRelationLoaders(db, registry),
+      programmaticMemo: /* @__PURE__ */ new WeakMap()
+    })
+  });
+  return (c) => yoga.fetch(c.req.raw, {});
+}
+var import_graphql_yoga;
+var init_handler = __esm({
+  "src/graphql/handler.ts"() {
+    "use strict";
+    import_graphql_yoga = require("graphql-yoga");
+    init_schema();
+    init_dataloaders();
+    init_security();
+  }
+});
+
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
@@ -72,26 +1000,43 @@ function createCorsMiddleware(corsConfig) {
 }
 
 // src/middleware/security-headers.ts
+var GRAPHIQL_CDN = "https://unpkg.com";
 function createSecurityHeadersMiddleware(options = {}) {
   const connectSrc = ["'self'", ...options.connectSrc ?? []].join(" ");
-  const csp = [
-    "default-src 'self'",
-    "img-src 'self' data: https:",
-    "media-src 'self' https:",
-    "style-src 'self' 'unsafe-inline'",
-    "script-src 'self'",
-    "font-src 'self' data:",
-    `connect-src ${connectSrc}`,
-    "frame-ancestors 'none'",
-    "base-uri 'self'",
-    "form-action 'self'"
-  ].join("; ");
+  function buildCsp(parts) {
+    return [
+      "default-src 'self'",
+      "img-src 'self' data: https:",
+      "media-src 'self' https:",
+      `style-src ${parts.styleSrc}`,
+      `script-src ${parts.scriptSrc}`,
+      "font-src 'self' data:",
+      `connect-src ${parts.connectSrc}`,
+      ...parts.workerSrc ? [`worker-src ${parts.workerSrc}`] : [],
+      "frame-ancestors 'none'",
+      "base-uri 'self'",
+      "form-action 'self'"
+    ].join("; ");
+  }
+  const csp = buildCsp({
+    scriptSrc: "'self'",
+    styleSrc: "'self' 'unsafe-inline'",
+    connectSrc
+  });
+  const graphiqlCsp = buildCsp({
+    scriptSrc: `'self' 'unsafe-inline' ${GRAPHIQL_CDN}`,
+    styleSrc: `'self' 'unsafe-inline' ${GRAPHIQL_CDN}`,
+    connectSrc: `${connectSrc} ${GRAPHIQL_CDN}`,
+    workerSrc: "'self' blob:"
+  });
+  const graphiqlPath = options.graphiqlPath;
   return async function securityHeaders(c, next) {
     await next();
     c.res.headers.set("X-Content-Type-Options", "nosniff");
     c.res.headers.set("X-Frame-Options", "DENY");
     c.res.headers.set("Referrer-Policy", "no-referrer");
-    c.res.headers.set("Content-Security-Policy", csp);
+    const isGraphiql = graphiqlPath !== void 0 && c.req.path === graphiqlPath;
+    c.res.headers.set("Content-Security-Policy", isGraphiql ? graphiqlCsp : csp);
   };
 }
 
@@ -890,304 +1835,101 @@ function registerPublicMediaRoutes(app, mediaRepo, listRateLimit) {
     if (typeParam !== void 0 && !VALID_MEDIA_TYPES.has(typeParam)) {
       return c.json(
         {
-          ok: false,
-          error: {
-            code: "VALIDATION_ERROR",
-            message: `type must be one of: image, video, file`
-          }
-        },
-        422
-      );
-    }
-    const opts = {
-      page: pagination.page,
-      per_page: pagination.per_page
-    };
-    if (typeParam !== void 0) {
-      opts.type = typeParam;
-    }
-    const result = await mediaRepo.findMany(opts);
-    return c.json(result);
-  };
-  if (listRateLimit) {
-    app.get("/api/media", listRateLimit, mediaListHandler);
-  } else {
-    app.get("/api/media", mediaListHandler);
-  }
-  app.get("/api/media/:id", async (c) => {
-    const id = c.req.param("id");
-    const item = await mediaRepo.findOne(id);
-    if (!item) {
-      return c.json(
-        { ok: false, error: { code: "NOT_FOUND", message: "Media item not found" } },
-        404
-      );
-    }
-    return c.json({ ok: true, data: item });
-  });
-}
-
-// src/routes/admin/content.ts
-var import_drizzle_orm3 = require("drizzle-orm");
-
-// src/media-references.ts
-function extractMediaId(value) {
-  return typeof value === "string" && value !== "" ? value : null;
-}
-function topLevelMediaDelta(mediaFields, before, after) {
-  const added = [];
-  const removed = [];
-  for (const f of mediaFields) {
-    if (after !== null && !(f.name in after)) continue;
-    const oldId = before ? extractMediaId(before[f.name]) : null;
-    const newId = after ? extractMediaId(after[f.name]) : null;
-    if (newId === oldId) continue;
-    if (oldId) removed.push(oldId);
-    if (newId) added.push(newId);
-  }
-  return { added, removed };
-}
-function mergeMediaDeltas(...deltas) {
-  return {
-    added: deltas.flatMap((d) => d.added),
-    removed: deltas.flatMap((d) => d.removed)
-  };
-}
-async function applyMediaReferenceDelta(delta, mediaRepo) {
-  const added = new Set(delta.added);
-  const removed = new Set(delta.removed);
-  const netAdd = [...added].filter((id) => !removed.has(id));
-  const netRemove = [...removed].filter((id) => !added.has(id));
-  if (netAdd.length > 0) await mediaRepo.incrementReferenceCount(netAdd);
-  if (netRemove.length > 0) await mediaRepo.decrementReferenceCount(netRemove);
-}
-
-// src/relations.ts
-var import_node_crypto = __toESM(require("crypto"));
-var import_drizzle_orm2 = require("drizzle-orm");
-function quoteIdent(name) {
-  if (!/^[a-z][a-z0-9_-]*$/.test(name)) throw new Error(`Unsafe identifier: ${name}`);
-  return `"${name}"`;
-}
-function paragraphMediaFieldNames(pType) {
-  return new Set(
-    pType.fields.filter((f) => f.field_type === "image" || f.field_type === "video" || f.field_type === "file").map((f) => f.name)
-  );
-}
-async function fetchParagraphMediaIds(db, pType, itemId, fieldName) {
-  const mediaColumns = pType.fields.filter((f) => f.field_type === "image" || f.field_type === "video" || f.field_type === "file").map((f) => f.db_column.column_name);
-  if (mediaColumns.length === 0) return [];
-  const tbl = import_drizzle_orm2.sql.raw(quoteIdent(pType.db.table_name));
-  const cols = import_drizzle_orm2.sql.join(mediaColumns.map((c) => import_drizzle_orm2.sql.raw(quoteIdent(c))), import_drizzle_orm2.sql`, `);
-  const result = await db.execute(
-    import_drizzle_orm2.sql`SELECT ${cols} FROM ${tbl} WHERE parent_id = ${itemId} AND parent_field = ${fieldName}`
-  );
-  const ids = [];
-  for (const row of result.rows) {
-    for (const col of mediaColumns) {
-      const v = row[col];
-      if (typeof v === "string" && v !== "") ids.push(v);
-    }
-  }
-  return ids;
-}
-async function persistParagraphField(db, itemId, parentType, fieldName, pType, items) {
-  const removed = await fetchParagraphMediaIds(db, pType, itemId, fieldName);
-  const tbl = import_drizzle_orm2.sql.raw(quoteIdent(pType.db.table_name));
-  await db.execute(import_drizzle_orm2.sql`DELETE FROM ${tbl} WHERE parent_id = ${itemId} AND parent_field = ${fieldName}`);
-  const mediaFieldNames = paragraphMediaFieldNames(pType);
-  const added = [];
-  for (let i = 0; i < items.length; i++) {
-    const pItem = items[i];
-    const data = {
-      id: import_node_crypto.default.randomUUID(),
-      parent_id: itemId,
-      parent_type: parentType,
-      parent_field: fieldName,
-      order: i,
-      created_at: /* @__PURE__ */ new Date(),
-      updated_at: /* @__PURE__ */ new Date()
-    };
-    for (const pf of pType.fields) {
-      if (!pf.db_column || pf.db_column.junction) continue;
-      data[pf.db_column.column_name] = pItem[pf.name] ?? null;
-    }
-    const cols = import_drizzle_orm2.sql.join(Object.keys(data).map((k) => import_drizzle_orm2.sql.raw(quoteIdent(k))), import_drizzle_orm2.sql`, `);
-    const vals = import_drizzle_orm2.sql.join(Object.values(data).map((v) => import_drizzle_orm2.sql`${v}`), import_drizzle_orm2.sql`, `);
-    await db.execute(import_drizzle_orm2.sql`INSERT INTO ${tbl} (${cols}) VALUES (${vals})`);
-    for (const name of mediaFieldNames) {
-      const val = pItem[name];
-      if (typeof val === "string" && val !== "") added.push(val);
-    }
-  }
-  return { added, removed };
-}
-async function deleteParagraphField(db, itemId, fieldName, pType) {
-  const removed = await fetchParagraphMediaIds(db, pType, itemId, fieldName);
-  const tbl = import_drizzle_orm2.sql.raw(quoteIdent(pType.db.table_name));
-  await db.execute(import_drizzle_orm2.sql`DELETE FROM ${tbl} WHERE parent_id = ${itemId} AND parent_field = ${fieldName}`);
-  return { added: [], removed };
-}
-async function persistJunctionField(db, itemId, junction, relatedIds) {
-  const tbl = import_drizzle_orm2.sql.raw(quoteIdent(junction.table_name));
-  const left = import_drizzle_orm2.sql.raw(quoteIdent(junction.left_column));
-  const right = import_drizzle_orm2.sql.raw(quoteIdent(junction.right_column));
-  await db.execute(import_drizzle_orm2.sql`DELETE FROM ${tbl} WHERE ${left} = ${itemId}`);
-  for (const rid of relatedIds) {
-    await db.execute(import_drizzle_orm2.sql`INSERT INTO ${tbl} (${left}, ${right}) VALUES (${itemId}, ${rid})`);
-  }
-}
-function buildRelationsMap(fields, registry) {
-  const relations = {};
-  for (const field of fields) {
-    if (field.field_type === "image" || field.field_type === "video" || field.field_type === "file") {
-      if (!field.db_column) continue;
-      relations[field.name] = { type: "media", fk_column: field.db_column.column_name };
-    } else if (field.field_type === "paragraph") {
-      const ref = field.ui_component.ref;
-      const pType = ref ? registry.paragraph_types[ref] : void 0;
-      if (!pType) continue;
-      relations[field.name] = { type: "paragraph", table: pType.db.table_name };
-    } else if (field.field_type === "reference") {
-      if (!field.db_column) continue;
-      if (field.db_column.junction) {
-        const j = field.db_column.junction;
-        relations[field.name] = {
-          type: "junction",
-          table: j.right_table,
-          junction_table: j.table_name,
-          left_column: j.left_column,
-          right_column: j.right_column,
-          order_column: j.order_column
-        };
-      } else if (field.db_column.foreign_key) {
-        relations[field.name] = {
-          type: "reference",
-          table: field.db_column.foreign_key.table,
-          fk_column: field.db_column.column_name
-        };
-      }
-    }
-  }
-  return relations;
-}
-function groupBy(items, key) {
-  const result = {};
-  for (const item of items) {
-    const k = String(item[key]);
-    if (!result[k]) result[k] = [];
-    result[k].push(item);
-  }
-  return result;
-}
-async function resolveRelationField(db, rows, fieldName, rel, cache) {
-  if (rows.length === 0) return;
-  if (rel.type === "paragraph") {
-    const parentIds = rows.map((r) => r["id"]);
-    const inList = import_drizzle_orm2.sql.join(parentIds.map((id) => import_drizzle_orm2.sql`${id}`), import_drizzle_orm2.sql`, `);
-    const result = await db.execute(
-      import_drizzle_orm2.sql`SELECT * FROM ${import_drizzle_orm2.sql.raw(quoteIdent(rel.table))} WHERE parent_id IN (${inList}) ORDER BY "order" ASC`
-    );
-    const byParent = groupBy(result.rows, "parent_id");
-    for (const row of rows) {
-      row[fieldName] = byParent[row["id"]] ?? [];
-    }
-  } else if (rel.type === "reference") {
-    const fkValues = rows.map((r) => r[rel.fk_column]).filter(Boolean);
-    if (fkValues.length === 0) {
-      for (const row of rows) row[fieldName] = null;
-      return;
-    }
-    const unique = [...new Set(fkValues)];
-    const uncached = unique.filter((id) => !cache.has(`${rel.table}:${id}`));
-    if (uncached.length > 0) {
-      const inList = import_drizzle_orm2.sql.join(uncached.map((id) => import_drizzle_orm2.sql`${id}`), import_drizzle_orm2.sql`, `);
-      const result = await db.execute(
-        import_drizzle_orm2.sql`SELECT * FROM ${import_drizzle_orm2.sql.raw(quoteIdent(rel.table))} WHERE id IN (${inList})`
-      );
-      for (const item of result.rows) {
-        cache.set(`${rel.table}:${item["id"]}`, item);
-      }
-    }
-    for (const row of rows) {
-      const fkVal = row[rel.fk_column];
-      row[fieldName] = fkVal ? cache.get(`${rel.table}:${fkVal}`) ?? null : null;
-    }
-  } else if (rel.type === "junction") {
-    const parentIds = rows.map((r) => r["id"]);
-    const inList = import_drizzle_orm2.sql.join(parentIds.map((id) => import_drizzle_orm2.sql`${id}`), import_drizzle_orm2.sql`, `);
-    const orderBy = rel.order_column ? import_drizzle_orm2.sql` ORDER BY "order" ASC` : import_drizzle_orm2.sql``;
-    const junctionResult = await db.execute(
-      import_drizzle_orm2.sql`SELECT * FROM ${import_drizzle_orm2.sql.raw(quoteIdent(rel.junction_table))} WHERE ${import_drizzle_orm2.sql.raw(quoteIdent(rel.left_column))} IN (${inList})${orderBy}`
-    );
-    const jRows = junctionResult.rows;
-    const rightIds = [...new Set(jRows.map((r) => r[rel.right_column]))];
-    const uncached = rightIds.filter((id) => !cache.has(`${rel.table}:${id}`));
-    if (uncached.length > 0) {
-      const rightInList = import_drizzle_orm2.sql.join(uncached.map((id) => import_drizzle_orm2.sql`${id}`), import_drizzle_orm2.sql`, `);
-      const entitiesResult = await db.execute(
-        import_drizzle_orm2.sql`SELECT * FROM ${import_drizzle_orm2.sql.raw(quoteIdent(rel.table))} WHERE id IN (${rightInList})`
-      );
-      for (const item of entitiesResult.rows) {
-        cache.set(`${rel.table}:${item["id"]}`, item);
-      }
-    }
-    const byLeft = groupBy(jRows, rel.left_column);
-    for (const row of rows) {
-      const jEntries = byLeft[row["id"]] ?? [];
-      row[fieldName] = jEntries.map((jr) => cache.get(`${rel.table}:${jr[rel.right_column]}`)).filter(Boolean);
-    }
-  } else if (rel.type === "media") {
-    const fkValues = rows.map((r) => r[rel.fk_column]).filter(Boolean);
-    if (fkValues.length === 0) {
-      for (const row of rows) row[fieldName] = null;
-      return;
-    }
-    const unique = [...new Set(fkValues)];
-    const uncached = unique.filter((id) => !cache.has(`media:${id}`));
-    if (uncached.length > 0) {
-      const inList = import_drizzle_orm2.sql.join(uncached.map((id) => import_drizzle_orm2.sql`${id}`), import_drizzle_orm2.sql`, `);
-      const result = await db.execute(import_drizzle_orm2.sql`SELECT * FROM "media" WHERE id IN (${inList})`);
-      for (const item of result.rows) {
-        cache.set(`media:${item["id"]}`, item);
-      }
+          ok: false,
+          error: {
+            code: "VALIDATION_ERROR",
+            message: `type must be one of: image, video, file`
+          }
+        },
+        422
+      );
     }
-    for (const row of rows) {
-      const fkVal = row[rel.fk_column];
-      row[fieldName] = fkVal ? cache.get(`media:${fkVal}`) ?? null : null;
+    const opts = {
+      page: pagination.page,
+      per_page: pagination.per_page
+    };
+    if (typeParam !== void 0) {
+      opts.type = typeParam;
     }
+    const result = await mediaRepo.findMany(opts);
+    return c.json(result);
+  };
+  if (listRateLimit) {
+    app.get("/api/media", listRateLimit, mediaListHandler);
+  } else {
+    app.get("/api/media", mediaListHandler);
   }
-}
-async function resolveRelationBareIds(db, rows, fieldName, rel) {
-  if (rows.length === 0) return;
-  if (rel.type === "paragraph") {
-    const parentIds = rows.map((r) => r["id"]);
-    const inList = import_drizzle_orm2.sql.join(parentIds.map((id) => import_drizzle_orm2.sql`${id}`), import_drizzle_orm2.sql`, `);
-    const result = await db.execute(
-      import_drizzle_orm2.sql`SELECT id, parent_id FROM ${import_drizzle_orm2.sql.raw(quoteIdent(rel.table))} WHERE parent_id IN (${inList}) ORDER BY "order" ASC`
-    );
-    const byParent = groupBy(result.rows, "parent_id");
-    for (const row of rows) {
-      row[fieldName] = (byParent[row["id"]] ?? []).map((r) => r["id"]);
-    }
-  } else if (rel.type === "junction") {
-    const parentIds = rows.map((r) => r["id"]);
-    const inList = import_drizzle_orm2.sql.join(parentIds.map((id) => import_drizzle_orm2.sql`${id}`), import_drizzle_orm2.sql`, `);
-    const result = await db.execute(
-      import_drizzle_orm2.sql`SELECT ${import_drizzle_orm2.sql.raw(quoteIdent(rel.left_column))} AS left_id, ${import_drizzle_orm2.sql.raw(quoteIdent(rel.right_column))} AS right_id FROM ${import_drizzle_orm2.sql.raw(quoteIdent(rel.junction_table))} WHERE ${import_drizzle_orm2.sql.raw(quoteIdent(rel.left_column))} IN (${inList})`
-    );
-    const byLeft = groupBy(result.rows, "left_id");
-    for (const row of rows) {
-      row[fieldName] = (byLeft[row["id"]] ?? []).map((r) => r["right_id"]);
+  app.get("/api/media/:id", async (c) => {
+    const id = c.req.param("id");
+    const item = await mediaRepo.findOne(id);
+    if (!item) {
+      return c.json(
+        { ok: false, error: { code: "NOT_FOUND", message: "Media item not found" } },
+        404
+      );
     }
+    return c.json({ ok: true, data: item });
+  });
+}
+
+// src/routes/admin/content.ts
+var import_drizzle_orm3 = require("drizzle-orm");
+
+// src/media-references.ts
+function extractMediaId(value) {
+  return typeof value === "string" && value !== "" ? value : null;
+}
+function topLevelMediaDelta(mediaFields, before, after) {
+  const added = [];
+  const removed = [];
+  for (const f of mediaFields) {
+    if (after !== null && !(f.name in after)) continue;
+    const oldId = before ? extractMediaId(before[f.name]) : null;
+    const newId = after ? extractMediaId(after[f.name]) : null;
+    if (newId === oldId) continue;
+    if (oldId) removed.push(oldId);
+    if (newId) added.push(newId);
   }
+  return { added, removed };
+}
+function mergeMediaDeltas(...deltas) {
+  return {
+    added: deltas.flatMap((d) => d.added),
+    removed: deltas.flatMap((d) => d.removed)
+  };
+}
+async function applyMediaReferenceDelta(delta, mediaRepo) {
+  const added = new Set(delta.added);
+  const removed = new Set(delta.removed);
+  const netAdd = [...added].filter((id) => !removed.has(id));
+  const netRemove = [...removed].filter((id) => !added.has(id));
+  if (netAdd.length > 0) await mediaRepo.incrementReferenceCount(netAdd);
+  if (netRemove.length > 0) await mediaRepo.decrementReferenceCount(netRemove);
 }
 
 // src/routes/admin/content.ts
+init_relations();
 function quoteIdent2(name) {
   if (!/^[a-z][a-z0-9_-]*$/.test(name)) throw new Error(`Unsafe identifier: ${name}`);
   return `"${name}"`;
 }
+async function loadParagraphRows(db, registry, pType, parentId, fieldName) {
+  const result = await db.execute(
+    import_drizzle_orm3.sql`SELECT * FROM ${import_drizzle_orm3.sql.raw(quoteIdent2(pType.db.table_name))} WHERE parent_id = ${parentId} AND parent_field = ${fieldName} ORDER BY "order" ASC`
+  );
+  const rows = result.rows;
+  for (const nf of pType.fields) {
+    if (nf.db_column !== null) continue;
+    const comp = nf.ui_component;
+    if (comp.component !== "paragraph-embed" || !comp.ref) continue;
+    const nType = registry.paragraph_types[comp.ref];
+    if (!nType) continue;
+    for (const row of rows) {
+      row[nf.name] = await loadParagraphRows(db, registry, nType, row["id"], nf.name);
+    }
+  }
+  return rows;
+}
 async function lookupBasePathId(db, pathOrName) {
   const r = await db.execute(
     import_drizzle_orm3.sql`SELECT id FROM base_paths WHERE path = ${pathOrName} OR name = ${pathOrName} LIMIT 1`
@@ -1339,10 +2081,7 @@ function registerAdminContentRoutes(app, registry, repos, mediaRepo, requirePerm
               if (comp.component !== "paragraph-embed" || !comp.ref) continue;
               const pType = registry.paragraph_types[comp.ref];
               if (!pType) continue;
-              const r = await db.execute(
-                import_drizzle_orm3.sql`SELECT * FROM ${import_drizzle_orm3.sql.raw(quoteIdent2(pType.db.table_name))} WHERE parent_id = ${id} AND parent_field = ${f.name} ORDER BY "order" ASC`
-              );
-              row[f.name] = r.rows;
+              row[f.name] = await loadParagraphRows(db, registry, pType, id, f.name);
             } else if (f.db_column.junction) {
               const j = f.db_column.junction;
               const r = await db.execute(
@@ -1417,82 +2156,85 @@ function registerAdminContentRoutes(app, registry, repos, mediaRepo, requirePerm
             );
           }
         }
-        const fieldErrors = checkRequiredFields(requiredFields, body);
-        if (fieldErrors.length > 0) {
+        return writeNewItem(c, body);
+      }
+    );
+    const writeNewItem = async (c, body) => {
+      const fieldErrors = checkRequiredFields(requiredFields, body);
+      if (fieldErrors.length > 0) {
+        return c.json(
+          {
+            ok: false,
+            error: {
+              code: "VALIDATION_ERROR",
+              message: "Required fields are missing",
+              details: fieldErrors
+            }
+          },
+          422
+        );
+      }
+      if (body["published"] === true) {
+        const publishDeny = await requirePermission("content:edit")(c, async () => {
+        });
+        if (publishDeny) return publishDeny;
+      }
+      const paragraphFields = contentType.fields.filter((f) => f.db_column === null);
+      const junctionFields = contentType.fields.filter(
+        (f) => f.db_column !== null && f.db_column.junction !== void 0
+      );
+      const columnFields = contentType.fields.filter(
+        (f) => f.db_column !== null && f.db_column.junction === void 0
+      );
+      const columnData = {
+        published: body["published"] ?? false
+      };
+      if (contentType.only_one) {
+        columnData["slug"] = typeName;
+      } else {
+        columnData["slug"] = body["slug"];
+      }
+      for (const f of columnFields) {
+        const val = body[f.name];
+        columnData[f.db_column.column_name] = val !== void 0 ? val : null;
+      }
+      if (db) {
+        const basePathId = await lookupBasePathId(db, contentType.default_base_path);
+        if (!basePathId) {
           return c.json(
             {
               ok: false,
               error: {
-                code: "VALIDATION_ERROR",
-                message: "Required fields are missing",
-                details: fieldErrors
+                code: "BASE_PATH_NOT_FOUND",
+                message: `Base path '${contentType.default_base_path}' not found \u2014 run manguito migrate`
               }
             },
-            422
+            500
           );
         }
-        if (body["published"] === true) {
-          const publishDeny = await requirePermission("content:edit")(c, async () => {
-          });
-          if (publishDeny) return publishDeny;
-        }
-        const paragraphFields = contentType.fields.filter((f) => f.db_column === null);
-        const junctionFields = contentType.fields.filter(
-          (f) => f.db_column !== null && f.db_column.junction !== void 0
-        );
-        const columnFields = contentType.fields.filter(
-          (f) => f.db_column !== null && f.db_column.junction === void 0
-        );
-        const columnData = {
-          published: body["published"] ?? false
-        };
-        if (contentType.only_one) {
-          columnData["slug"] = typeName;
-        } else {
-          columnData["slug"] = body["slug"];
-        }
-        for (const f of columnFields) {
-          const val = body[f.name];
-          columnData[f.db_column.column_name] = val !== void 0 ? val : null;
-        }
-        if (db) {
-          const basePathId = await lookupBasePathId(db, contentType.default_base_path);
-          if (!basePathId) {
-            return c.json(
-              {
-                ok: false,
-                error: {
-                  code: "BASE_PATH_NOT_FOUND",
-                  message: `Base path '${contentType.default_base_path}' not found \u2014 run manguito migrate`
-                }
-              },
-              500
-            );
-          }
-          columnData["base_path_id"] = basePathId;
+        columnData["base_path_id"] = basePathId;
+      }
+      const item = await repo.create(columnData);
+      const itemId = item["id"];
+      const mediaDeltas = [topLevelMediaDelta(mediaFields, null, body)];
+      if (db) {
+        for (const f of paragraphFields) {
+          const comp = f.ui_component;
+          if (comp.component !== "paragraph-embed" || !comp.ref) continue;
+          const pType = registry.paragraph_types[comp.ref];
+          if (!pType) continue;
+          const items = Array.isArray(body[f.name]) ? body[f.name] : [];
+          mediaDeltas.push(await persistParagraphField(db, itemId, contentType.db.table_name, f.name, pType, items, registry));
         }
-        const item = await repo.create(columnData);
-        const itemId = item["id"];
-        const mediaDeltas = [topLevelMediaDelta(mediaFields, null, body)];
-        if (db) {
-          for (const f of paragraphFields) {
-            const comp = f.ui_component;
-            if (comp.component !== "paragraph-embed" || !comp.ref) continue;
-            const pType = registry.paragraph_types[comp.ref];
-            if (!pType) continue;
-            const items = Array.isArray(body[f.name]) ? body[f.name] : [];
-            mediaDeltas.push(await persistParagraphField(db, itemId, contentType.db.table_name, f.name, pType, items));
-          }
-          for (const f of junctionFields) {
-            const junction = f.db_column.junction;
-            const relatedIds = Array.isArray(body[f.name]) ? body[f.name].filter((v) => typeof v === "string") : [];
-            await persistJunctionField(db, itemId, junction, relatedIds);
-          }
+        for (const f of junctionFields) {
+          const junction = f.db_column.junction;
+          const relatedIds = Array.isArray(body[f.name]) ? body[f.name].filter((v) => typeof v === "string") : [];
+          await persistJunctionField(db, itemId, junction, relatedIds);
         }
-        await applyMediaReferenceDelta(mergeMediaDeltas(...mediaDeltas), mediaRepo);
-        return c.json({ ok: true, data: item }, 201);
       }
-    );
+      await applyMediaReferenceDelta(mergeMediaDeltas(...mediaDeltas), mediaRepo);
+      return c.json({ ok: true, data: item }, 201);
+    };
     app.patch(
       `/admin/api/${basePath}/:id`,
       requirePermission("content:edit"),
@@ -1547,71 +2289,92 @@ function registerAdminContentRoutes(app, registry, repos, mediaRepo, requirePerm
             );
           }
         }
-        if (body["published"] === true) {
-          const publishDeny = await requirePermission("content:edit")(c, async () => {
-          });
-          if (publishDeny) return publishDeny;
-          const merged = { ...existing, ...body };
-          const fieldErrors = checkRequiredFields(requiredFields, merged);
-          if (fieldErrors.length > 0) {
-            return c.json(
-              {
-                ok: false,
-                error: {
-                  code: "PUBLISH_VALIDATION_ERROR",
-                  message: "Cannot publish \u2014 required fields are missing",
-                  details: fieldErrors
-                }
-              },
-              422
-            );
-          }
+        return writeExistingItem(c, id, existing, body);
+      }
+    );
+    const writeExistingItem = async (c, id, existing, body) => {
+      if (body["published"] === true) {
+        const publishDeny = await requirePermission("content:edit")(c, async () => {
+        });
+        if (publishDeny) return publishDeny;
+        const merged = { ...existing, ...body };
+        const fieldErrors = checkRequiredFields(requiredFields, merged);
+        if (fieldErrors.length > 0) {
+          return c.json(
+            {
+              ok: false,
+              error: {
+                code: "PUBLISH_VALIDATION_ERROR",
+                message: "Cannot publish \u2014 required fields are missing",
+                details: fieldErrors
+              }
+            },
+            422
+          );
         }
-        const patchParagraphFields = contentType.fields.filter((f) => f.db_column === null);
-        const patchJunctionFields = contentType.fields.filter(
-          (f) => f.db_column !== null && f.db_column.junction !== void 0
-        );
-        const patchColumnFields = contentType.fields.filter(
-          (f) => f.db_column !== null && f.db_column.junction === void 0
+      }
+      const patchParagraphFields = contentType.fields.filter((f) => f.db_column === null);
+      const patchJunctionFields = contentType.fields.filter(
+        (f) => f.db_column !== null && f.db_column.junction !== void 0
+      );
+      const patchColumnFields = contentType.fields.filter(
+        (f) => f.db_column !== null && f.db_column.junction === void 0
+      );
+      const patchData = {};
+      if (!contentType.only_one && "slug" in body) patchData["slug"] = body["slug"];
+      if ("published" in body) patchData["published"] = body["published"];
+      for (const f of patchColumnFields) {
+        if (f.name in body) {
+          const val = body[f.name];
+          patchData[f.db_column.column_name] = val !== void 0 ? val : null;
+        }
+      }
+      const updated = await repo.update(id, patchData);
+      if (!updated) {
+        return c.json(
+          { ok: false, error: { code: "NOT_FOUND", message: "Not found" } },
+          404
         );
-        const patchData = {};
-        if (!contentType.only_one && "slug" in body) patchData["slug"] = body["slug"];
-        if ("published" in body) patchData["published"] = body["published"];
-        for (const f of patchColumnFields) {
-          if (f.name in body) {
-            const val = body[f.name];
-            patchData[f.db_column.column_name] = val !== void 0 ? val : null;
-          }
+      }
+      const mediaDeltas = [
+        topLevelMediaDelta(mediaFields, existing, body)
+      ];
+      if (db) {
+        for (const f of patchParagraphFields) {
+          const comp = f.ui_component;
+          if (comp.component !== "paragraph-embed" || !comp.ref) continue;
+          const pType = registry.paragraph_types[comp.ref];
+          if (!pType) continue;
+          const items = Array.isArray(body[f.name]) ? body[f.name] : [];
+          mediaDeltas.push(await persistParagraphField(db, id, contentType.db.table_name, f.name, pType, items, registry));
         }
-        const updated = await repo.update(id, patchData);
-        if (!updated) {
-          return c.json(
-            { ok: false, error: { code: "NOT_FOUND", message: "Not found" } },
-            404
-          );
+        for (const f of patchJunctionFields) {
+          const junction = f.db_column.junction;
+          const relatedIds = Array.isArray(body[f.name]) ? body[f.name].filter((v) => typeof v === "string") : [];
+          await persistJunctionField(db, id, junction, relatedIds);
         }
-        const mediaDeltas = [
-          topLevelMediaDelta(mediaFields, existing, body)
-        ];
-        if (db) {
-          for (const f of patchParagraphFields) {
-            const comp = f.ui_component;
-            if (comp.component !== "paragraph-embed" || !comp.ref) continue;
-            const pType = registry.paragraph_types[comp.ref];
-            if (!pType) continue;
-            const items = Array.isArray(body[f.name]) ? body[f.name] : [];
-            mediaDeltas.push(await persistParagraphField(db, id, contentType.db.table_name, f.name, pType, items));
-          }
-          for (const f of patchJunctionFields) {
-            const junction = f.db_column.junction;
-            const relatedIds = Array.isArray(body[f.name]) ? body[f.name].filter((v) => typeof v === "string") : [];
-            await persistJunctionField(db, id, junction, relatedIds);
+      }
+      await applyMediaReferenceDelta(mergeMediaDeltas(...mediaDeltas), mediaRepo);
+      return c.json({ ok: true, data: updated });
+    };
+    if (contentType.only_one) {
+      app.put(
+        `/admin/api/${basePath}`,
+        requirePermission("content:edit"),
+        async (c) => {
+          const body = await c.req.json();
+          const existingResult = await repo.findMany({ page: 1, per_page: 1 });
+          const existing = existingResult.data[0];
+          if (!existing) {
+            const createDeny = await requirePermission("content:create")(c, async () => {
+            });
+            if (createDeny) return createDeny;
+            return writeNewItem(c, body);
           }
+          return writeExistingItem(c, existing["id"], existing, body);
         }
-        await applyMediaReferenceDelta(mergeMediaDeltas(...mediaDeltas), mediaRepo);
-        return c.json({ ok: true, data: updated });
-      }
-    );
+      );
+    }
     app.delete(
       `/admin/api/${basePath}/:id`,
       requirePermission("content:delete"),
@@ -1633,7 +2396,7 @@ function registerAdminContentRoutes(app, registry, repos, mediaRepo, requirePerm
             if (comp.component !== "paragraph-embed" || !comp.ref) continue;
             const pType = registry.paragraph_types[comp.ref];
             if (!pType) continue;
-            mediaDeltas.push(await deleteParagraphField(db, id, f.name, pType));
+            mediaDeltas.push(await deleteParagraphField(db, id, f.name, pType, registry));
           }
         }
         await applyMediaReferenceDelta(mergeMediaDeltas(...mediaDeltas), mediaRepo);
@@ -1748,7 +2511,7 @@ function registerAdminContentRoutes(app, registry, repos, mediaRepo, requirePerm
             const pType = registry.paragraph_types[comp.ref];
             if (!pType) continue;
             const items = Array.isArray(body[f.name]) ? body[f.name] : [];
-            mediaDeltas.push(await persistParagraphField(db, taxItemId, taxonomyType.db.table_name, f.name, pType, items));
+            mediaDeltas.push(await persistParagraphField(db, taxItemId, taxonomyType.db.table_name, f.name, pType, items, registry));
           }
         }
         await applyMediaReferenceDelta(mergeMediaDeltas(...mediaDeltas), mediaRepo);
@@ -1817,7 +2580,7 @@ function registerAdminContentRoutes(app, registry, repos, mediaRepo, requirePerm
             const pType = registry.paragraph_types[comp.ref];
             if (!pType) continue;
             const items = Array.isArray(body[f.name]) ? body[f.name] : [];
-            mediaDeltas.push(await persistParagraphField(db, id, taxonomyType.db.table_name, f.name, pType, items));
+            mediaDeltas.push(await persistParagraphField(db, id, taxonomyType.db.table_name, f.name, pType, items, registry));
           }
         }
         await applyMediaReferenceDelta(mergeMediaDeltas(...mediaDeltas), mediaRepo);
@@ -1845,7 +2608,7 @@ function registerAdminContentRoutes(app, registry, repos, mediaRepo, requirePerm
             if (comp.component !== "paragraph-embed" || !comp.ref) continue;
             const pType = registry.paragraph_types[comp.ref];
             if (!pType) continue;
-            mediaDeltas.push(await deleteParagraphField(db, id, f.name, pType));
+            mediaDeltas.push(await deleteParagraphField(db, id, f.name, pType, registry));
           }
         }
         await applyMediaReferenceDelta(mergeMediaDeltas(...mediaDeltas), mediaRepo);
@@ -2813,7 +3576,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
 var import_drizzle_orm6 = require("drizzle-orm");
 var API_VERSION = (() => {
   try {
-    return "0.2.0";
+    return "0.3.2";
   } catch {
     return "0.0.0";
   }
@@ -2920,6 +3683,7 @@ function registerSchemaRoute(app, registry, db) {
 // src/repositories/content.ts
 var import_node_crypto3 = __toESM(require("crypto"));
 var import_drizzle_orm8 = require("drizzle-orm");
+init_relations();
 var SORTABLE_FIELDS2 = /* @__PURE__ */ new Set(["title", "created_at", "updated_at"]);
 function codeError(code, message) {
   const err = new Error(message);
@@ -2975,7 +3739,7 @@ function whereFragment(conds) {
   return conds.length > 0 ? import_drizzle_orm8.sql` WHERE ${import_drizzle_orm8.sql.join(conds, import_drizzle_orm8.sql` AND `)}` : import_drizzle_orm8.sql``;
 }
 function createDrizzleContentRepository(db, tableName, options = {}) {
-  const { relations = {} } = options;
+  const { relations = {}, publishedRelations = false } = options;
   function tableRaw() {
     return import_drizzle_orm8.sql.raw(quoteIdent3(tableName));
   }
@@ -2988,7 +3752,7 @@ function createDrizzleContentRepository(db, tableName, options = {}) {
     }
     for (const [fieldName, rel] of Object.entries(relations)) {
       if (rel.type === "media") {
-        await resolveRelationField(db, rows, fieldName, rel, cache);
+        await resolveRelationField(db, rows, fieldName, rel, cache, publishedRelations);
       } else if (!include.includes(fieldName)) {
         await resolveRelationBareIds(db, rows, fieldName, rel);
       }
@@ -2996,7 +3760,7 @@ function createDrizzleContentRepository(db, tableName, options = {}) {
     for (const fieldName of include) {
       const rel = relations[fieldName];
       if (rel.type !== "media") {
-        await resolveRelationField(db, rows, fieldName, rel, cache);
+        await resolveRelationField(db, rows, fieldName, rel, cache, publishedRelations);
       }
     }
     return rows;
@@ -3117,6 +3881,9 @@ function createDrizzleContentRepository(db, tableName, options = {}) {
   };
 }
 
+// src/app.ts
+init_relations();
+
 // src/repositories/media.ts
 var import_node_crypto4 = __toESM(require("crypto"));
 var import_drizzle_orm9 = require("drizzle-orm");
@@ -3234,7 +4001,14 @@ function createCmsApp(options) {
   const programmaticResolver = createProgrammaticResolver(resolverMap);
   const app = new import_hono.Hono();
   const uploadOrigins = storage.getUploadOrigins?.() ?? [];
-  app.use("*", createSecurityHeadersMiddleware({ connectSrc: uploadOrigins }));
+  const graphiqlEnabled = options.graphql?.enabled === true && options.graphql.graphiql === true;
+  app.use(
+    "*",
+    createSecurityHeadersMiddleware({
+      connectSrc: uploadOrigins,
+      ...graphiqlEnabled && { graphiqlPath: "/graphql" }
+    })
+  );
   app.use("*", createCorsMiddleware(cors ?? { origin: "*", enabled: true }));
   app.onError(errorHandler);
   const listRateLimit = resolveListRateLimit(rateLimit);
@@ -3269,7 +4043,8 @@ function createCmsApp(options) {
     Object.entries(registry.content_types).map(([typeName, ct]) => [
       typeName,
       createDrizzleContentRepository(db, ct.db.table_name, {
-        relations: buildRelationsMap(ct.fields, registry)
+        relations: buildRelationsMap(ct.fields, registry),
+        publishedRelations: true
       })
     ])
   );
@@ -3277,11 +4052,22 @@ function createCmsApp(options) {
     Object.entries(registry.taxonomy_types).map(([typeName, tt]) => [
       typeName,
       createDrizzleContentRepository(db, tt.db.table_name, {
-        relations: buildRelationsMap(tt.fields, registry)
+        relations: buildRelationsMap(tt.fields, registry),
+        publishedRelations: true
       })
     ])
   );
   const publicRepos = { ...publicContentRepos, ...publicTaxonomyRepos };
+  const graphqlRepos = Object.fromEntries([
+    ...Object.entries(registry.content_types).map(([typeName, ct]) => [
+      typeName,
+      createDrizzleContentRepository(db, ct.db.table_name)
+    ]),
+    ...Object.entries(registry.taxonomy_types).map(([typeName, tt]) => [
+      typeName,
+      createDrizzleContentRepository(db, tt.db.table_name)
+    ])
+  ]);
   registerAuthRoutes(app, db);
   app.use("/admin/api/*", authMiddleware);
   app.use("/admin/api/*", mustChangePasswordCheck);
@@ -3318,6 +4104,35 @@ function createCmsApp(options) {
   );
   registerPublicContentRoutes(app, registry, publicRepos, listRateLimit, programmaticResolver);
   registerPublicMediaRoutes(app, mediaRepo, listRateLimit);
+  if (options.graphql?.enabled) {
+    const gqlOptions = options.graphql;
+    let gqlHandler = null;
+    let initError = null;
+    const ready = Promise.resolve().then(() => (init_handler(), handler_exports)).then(({ createGraphQLHandler: createGraphQLHandler2 }) => {
+      gqlHandler = createGraphQLHandler2(registry, graphqlRepos, programmaticResolver, db, gqlOptions);
+    }).catch((err) => {
+      initError = err;
+      const message = err instanceof Error ? err.message : String(err);
+      process.stderr.write(`\u2717 GraphQL schema failed to initialize; /graphql will return 500. ${message}
+`);
+    });
+    const invokeGraphQL = async (c) => {
+      if (!gqlHandler && !initError) await ready;
+      if (!gqlHandler) {
+        return c.json(
+          { ok: false, error: { code: "GRAPHQL_INIT_FAILED", message: "GraphQL schema failed to initialize" } },
+          500
+        );
+      }
+      return gqlHandler(c, async () => {
+      });
+    };
+    if (listRateLimit) {
+      app.all("/graphql", listRateLimit, invokeGraphQL);
+    } else {
+      app.all("/graphql", invokeGraphQL);
+    }
+  }
   registerConfigRoute(
     app,
     {
@@ -3364,13 +4179,24 @@ function createServer(options = {}) {
 }
 
 // src/index.ts
+function resolveGraphQL(cfg) {
+  const devDefault = process.env["NODE_ENV"] !== "production";
+  return {
+    enabled: cfg.enabled ?? false,
+    maxDepth: cfg.maxDepth ?? 8,
+    maxComplexity: cfg.maxComplexity ?? 1e3,
+    graphiql: cfg.graphiql ?? devDefault,
+    introspection: cfg.introspection ?? cfg.graphiql ?? devDefault
+  };
+}
 function createAPIAdapter(options = {}) {
   const prefix = options.prefix ?? "/api";
   const media = options.media?.max_file_size !== void 0 ? { max_file_size: options.media.max_file_size } : void 0;
   return {
     prefix,
     ...media !== void 0 && { media },
-    ...options.rateLimit !== void 0 && { rateLimit: options.rateLimit }
+    ...options.rateLimit !== void 0 && { rateLimit: options.rateLimit },
+    ...options.graphql !== void 0 && { graphql: resolveGraphQL(options.graphql) }
   };
 }
 // Annotate the CommonJS export names for ESM import in node: